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We present a scheme for hiding bits in Bell states that is secure even when the sharers Alice and 
Bob are allowed to carry out local quantum operations and classical communication. We prove that 
the information that Alice and Bob can gain about a hidden bit is exponentially small in n, the 
number of qubits in each share, and can be made arbitrarily small for hiding multiple bits. We 
indicate an alternative efficient low-entanglement method for preparing the shared quantum states. 
We discuss how our scheme can be implemented using present-day quantum optics. 
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The protection of a secret by sharing it, that is, by ap- 
portioning the secret data among two or more parties so 
that the data only become intelligible as a consequence 
of their cooperative action, is an important capability in 
modern information processing. Here we give a method 
of using particular quantum states to share a secret be- 
tween two parties (Alice and Bob), in which the data is 
hidden in a fundamentally stronger way than is possi- 
ble in any classical scheme. We prove that even if Alice 
and Bob can communicate via a classical channel, they 
can only obtain arbitrarily little information about the 
hidden data. They can unlock the secret only by joint 
quantum measurements, which require either a quantum 
channel, shared quantum entanglement, or direct inter- 
action between them. We show that the creation of these 
secret shares can be done with just a small expenditure 
of quantum entanglement: no more than one Einstein- 
Podolsky-Rosen pair per secret bit shared. 

Our results are part of a larger exploration of the 
information-theoretic capabilities of quantum mechan- 
ics, notable examples of which (quantum key distribu- 
tion [0 and quantum teleportation ||]) have now begun 
to be realized in the laboratory. The extent to which 
quantum states can hide shared data can be viewed as a 
new information-theoretic characterization of the quan- 
tum nonlocality of these states. Other workers have pre- 
viously identified quantum secret sharing protocols HQ , 
in which participants (possibly more than two) receive 
shares of either quantum or classical data. In this previ- 
ous work, however, there is no guarantee that the data 
remains hidden if the parties choose to communicate clas- 
sically. In fact, recent analysis || has shown that, for a 
single hidden bit, secrecy in the presence of classical com- 
munication is impossible if the shares consist of parts of 
two orthogonal pure quantum states. This stronger form 
of data hiding is nonetheless possible, as we will show, 
but only when the shares are made up from mixed quan- 
tum states. 

Unlike usual secret sharing schemes, the security in our 
scheme does not depend on certain parties being honest 
or malevolent; we assume that both Alice and Bob are 
malevolent in the sense that they would go to any length 



to determine the hidden bit. The security of our scheme 
relies on the fact that Alice and Bob are restricted in 
their operations, a condition that could be enforced by 
a third party. One can imagine, for example, a situation 
in which the third party (the boss) has a piece of data 
on which she would like Alice and Bob (some employ- 
ees) to act without the sensitive data being revealed to 
them, or, in another scenario, the secret could be given 
to Alice and Bob and be revealed to them at a later 
stage determined by the boss. Our scheme is such that 
at some later stage, the boss can provide the employees 
with entanglement that enables the parties to determine 
the secret with 100% certainty. This last idea can in fact 
be used to establish a form of conditionally secure quan- 
tum bit commitment ||. For these scenarios to work, 
we have to assume that the boss controls the (quantum) 
channel which connects the two parties: Alice and Bob 
are not allowed to communicate via a quantum channel. 
This prohibition can be enforced by the boss by putting 
dephasing or noisy operations in their channel. Further- 
more, the boss controls the labs in which the employees 
operate; for example she can, prior to operation, sweep 
those labs clean of any entanglement (again by dephas- 
ing). 

We present our protocol and prove its security for a 
one-bit secret 6; at the end we indicate the proof of the 
security of its multibit extension. The protocol involves 
a "hider" (the boss above) who prepares one of two or- 
thogonal bipartite quantum states p^ Q or based on 
the value of 6, and presents the two parts of the state 
to Alice and Bob. n is an integer which determines the 
degree of security of the protocol. The hider is assumed 
to have a supply of each of the four Bell states, defined as 
|*±) = ^(|00>±|11» and |*±) = ^(|01)±|10». |*"> 
is a spin singlet while the other three are spin triplets. 
When 6=1, the hider picks at random a set of n Bell 
states with uniform probability, except that the number 
of singlets must be odd. The 6 = protocol is the same, 
except that the number of singlets must be even. The 
hider distributes the n Bell states to Alice and Bob; for 
each Bell state the first qubit goes to Alice and the second 
to Bob. 
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To prove the security of this protocol, we must con- 
sider what information Alice and Bob can gather about 
the bit b. We assume that Alice and Bob can perform any 
sequence of Local quantum Operations supplemented by 
unlimited 2-way Classical Communication (we abbrevi- 
ate this class of operations as LOCC). This class of oper- 
ations does not permit measurements in the basis of Bell 
states, from which the bit could easily be determined: 
Alice and Bob simply count the number of singlets mea- 
sured and compute the parity. In fact, we will show that 
the information that Alice and Bob can learn about the 
hidden bit is exponentially small in the number n of Bell 
states that the hider uses for the encoding. 

Before analyzing the security of our protocol, let 
us pause and consider the possibility for realizing our 
scheme in a physical experiment. The protocol that we 
have described above can be implemented in a present- 
day quantum optics lab in the following way. The hider 
needs to be able to make any one of the 4 Bell states; 
with an optical downconverter she can make a maxi- 
mally entangled state between two polarization modes 
7f(II)I) + l <_> ' <_> '))@ and b y further single qubit op- 
erations she can map this state onto any of the other three 
Bell states. The photons can be sent through two optical 
fibers to the Alice and Bob locations. Then Alice and 
Bob can attempt to unlock the secret by LOCC (in Ref. 
H we will describe an optimal and simple LOCC pro- 
cedure, involving only 1-qubit gates). For the complete 
unlocking of the secret, a quantum channel between Al- 
ice and Bob is opened up and Alice's photons are sent to 
Bob. Finally, Bob will need to do a measurement which 
distinguishes the singlet state ^=(| | ,«->) — | fr° m 
the other three other Bell states. Such an incomplete 
measurement has been performed in the lab fl; a full 
Bell measurement is not necessary and is also not techno- 
logically feasible in current experiments. Our alternative 
low-entanglement preparation scheme will be somewhat 
more involved in the lab but is interesting nonetheless. 
As we will discuss, what is needed are quantum oper- 
ations in the Clifford group, including some particular 
one-qubit gates obtainable by linear optics in addition 
to the CNOT gate which cannot be implemented per- 
fectly by using linear optical elements. However, recent 
work by Knill et al. || shows that a CNOT gate can be 
implemented near-deterministically in linear optics when 
single-photon sources are available. 

Let us now pass to the security proof of our scheme. 
The LOCC class, even though it plays a fundamental role 
in the theory of quantum entanglement, is remarkably 
hard to characterize succinctly ||. However, our analy- 
sis will rely on just one important feature that all LOCC 
operations share: they cannot create quantum entangle- 
ment between Alice and Bob if they are initially unen- 
tangled. We consider a general measurement scheme for 
Alice and Bob that, irrespective of its precise physical 



implementation, leads to just two final outcomes, "0" or 
"1" . It can thus be described as a POVM (Positive Oper- 
ator Valued Measure) measurement jl0| , with two POVM 
elements, Mq > and Mi > 0, associated with outcomes 
"0" and "1" respectively. In our case, Mo,i operate on a 
Hilbert space of dimension 2 2 ™ , corresponding to the di- 
mension of the input states. For an input density matrix 
p, the outcome b occurs with probability Tr (pMb). Prob- 
ability conservation implies that Mo + Mi = I, where I 
is the identity matrix. 
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FIG. 1. (a) A bipartite POVM measurement M per- 
formed on input p. Single horizontal lines are quantum reg- 
isters, and double lines are classical registers. The box repre- 
sents a protocol (and circuit) for performing M. (b) A LOCC 
protocol that prepares a state proportional to JVfjf . The two 
registers of the maximally entangled states l^max) are rep- 
resented by two lines connected in the far left. The output 
probabilities are given by Tr pMb with p = 7/4". 



A POVM measurement M for a bipartite input is de- 
picted in Fig. |l|(a). Such a POVM measurement imple- 
mented by LOCC cannot create quantum entanglement. 
This condition translates to two necessary conditions on 
the measurement, (1 <£> T)[Mb] > for b = 0, 1. Here, 
1 is the identity operation on Alice's system, T is the 
matrix transposition on Bob's system, T[|i)(j|] = 
and 1 ®T is called the partial transpose operation. These 
conditions are proved as follows: Suppose Alice and Bob 
each prepares a maximally entangled state \^ m ax) — 
Y^i=o 1 m bis own lab. Then they apply the 
measurement M, each on one register of |^ ma x), as il- 
lustrated in Fig. 0(b). When outcome b is obtained, the 
residual state in the two unmeasured halves is propor- 
tional to 

Pf K ^2 \ i 'j)( m ' n \ Tr i M b\hj){m,n\) 

= {hj\MT\m,n)\i,j)(m,n\ = Af b T , (1) 

where M^ is the matrix transpose of Mb. Thus 
Fig. |l](b) prescribes a LOCC procedure to create the 
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states /Ti (Mb), since the input maximally entangled 
states are prepared by Alice and Bob locally. There- 
fore, the states Mjf /Tr (Mb) are necessarily unentangled 
and, following the Peres criterion O], they are posi- 
tive under partial transposition (PPT), meaning that 
(l(g)T)[M b T ] > 0, which in turns implies (1®T)[M&] > 0. 

We now use the constraints that Mo,i are PPT to 
bound the probability of a successful measurement. In 
particular we consider the probability p |o that Alice 
and Bob decide for outcome "0" when the hider has 
prepared p^ (corresponding to the hidden bit 6 = 0), 

(n) 

which is equal to p |o = TtMqp q . Similarly we define 
pui = TrMiP]" , the probability of outcome "1" when 

p^ is prepared by the hider. 

First, we show that it is not necessary to consider the 
most general pair of PPT operators Mq and M\. If there 
exists a general pair (Mo, Mi) obeying the PPT con- 
straints, then there is another PPT pair (Mo, Mi) which 
is diagonal in the basis of n Bell states, such that the 
measurement with Mo and Mi has the same probabili- 
ties of success p |o an d Pi\i- Mq an d Mi are related to 
Mq and Mi by an action called partial twirling 12 which 
removes all off-diagonal terms in the Bell basis and leaves 
the diagonal terms unchanged. 

The argument involves three observations. (1) Par- 
tial twirling can be implemented by LOCC operations 
jl2| which preserve the PPT property Q. Thus (1 ® 
T)[Mo,i] > 0. (2) The trace-preservation condition 
Mo + Mi = I is invariant under twirling, and therefore 
Mq + Mi = /. (3) The states to be measured, Pq and 

(n) 

p\ , are mixtures of tensor products of n Bell states and 
thus are Bell-diagonal. It follows that p |o — Tr-WoPo = 

(n) ~ (n) 

TtMoPq and likewise pi|i = TrMi/jj , because the off- 
diagonal terms of Mo,i do not contribute to the trace. 
This establishes the argument; we can, without loss of 
generality, restrict to a measurement with Bell diagonal 
POVM elements. 

To carry the analysis further we introduce a com- 
pact notation jl3] that represents each of the four Bell 
states by two bits, as follows: |<I> + } — > 00, |$~) — > 01, 
|*+) — > 10 and the singlet |*~) — > 11. A product of n 
Bell states is thus represented by a 2n-bit string s. The 
four Bell states can be rotated into each other by local 
Pauli-matrix rotations, involving one half of the entan- 
gled state only. In the language of binary strings, we can 
also associate two bits with each of the Pauli matrices, 
a x — ► 10, u z — ^ 01, (Ty — ^ 11 and / — * 00. This notation 
is convenient because the Pauli matrices then act on the 
two bits characterizing the Bell state by a bitwise XOR. 
For example (a z <g> /)| < E >+ ) = \&~) can be represented as 
01 © 00 = 01. Using the identity 



(i®r)[|$+>(*+|] = 

i(|$+}($+| + |$-><$-| + |*+)(*+| - |*-)(*-|) 



(2) 



permits the operators (1 ®T)® n [Mo,i] to be written very 
compactly in the binary-string notation. We denote the 
diagonal matrix elements of Mo and Mi in the basis of 
products of n Bell states (labeled by the 2n-bit string s) 
by a s and j3 B respectively. Using the fact that strings of 
Bell states can be converted to each other by local Pauli 
operations, we can compute the diagonal matrix elements 
of the equation (1 <g T)®"[Mo] > in the binary-string 
notation. We obtain the condition 



i (_ 1 )Wn(s) > 0; 



(3) 



for all 2n-bit strings m, where Nn(s) is the number 
of times that a 11 pair appears in the binary string s. 
Through the association of Bell states with 2n-bit strings, 
iVn(s) is precisely the number of singlets \^>~) among 
the set of n Bell states. The same calculation for Mi 
gives Es/Wn(-l) Wll(s) > for all m. With the rela- 
tion a s = 1 — (3 S , resulting directly from M + Mi = /, 
and the identity X) s ( — l)^ 1 *- 8 * 1 = 2™ (which can shown 
by evaluating a simple binomial sum), we obtain that, 
for all 2n-bit strings m 



< 



E 



l)^" « < 2". 



(4) 



By setting m = 00 ... 00 in this equation, we 
can express the probabilities of success, p |o = 
2/(2 2 " + 2»)E s | J v ll(s)i30Von as and p 1{1 = 2/(2 2 " - 
2") SslJVii(s) i= odd As; m terms of these two inequalities. 
This result bounds the sum p |o — 1 in both ways 



S < Po|o - 1 < 8-. 



(5) 



where S = l/2 n ~ 1 . This result establishes the hiding 
property: for 5 = (corresponding to n — > oo), Alice 
and Bob's measurement outcomes can be faithfully sim- 
ulated by a coin flip with bias Po|Oj an d so give no in- 
formation about the identity of the state. There is also 
an information-theoretic interpretation of this result; we 
can show [gj that, as a consequence of these inequali- 
ties, the mutual information [Q I(B : M) is bounded 
by 8H(B), where B is the bit value and M is the out- 
come of any LOCC measurement by Alice and Bob, not 
just a two-outcome one. Here H(B) |l4| is the Shannon 
information of the hidden bit, which equals 1 in the case 
of equal prior probabilities for 6 = and 6=1. 

We now return to the question of how the hider can 
produce the states p$ and p^ using minimal entangle- 
ment between the two shares. We will demand that the 
procedure to create p n ^ and p^ is efficient as a quantum 
computation, that is, since each hiding state consists of 
2n qubits, we seek a procedure to create these states with 
little entanglement, using a number of quantum compu- 
tation steps polynomial in n. 

We use a convenient alternative representation of these 
two density matrices: 



3 



In) 

Po 



(n-1) „ (1) 

q n p\ <8> Pi 



s (n-1) „ (1) 



(n) (n-1) 
Pi = PnPb 



Pi 



w+ii-p^r 1 ^^. (6) 



The mixing coefficients are determined by the uniformity 
of the Bell mixtures and proper normalization: 



q n = 



2(2" + l) 



Pr, 



2(2"-l)' 



(7) 



This representation can be easily understood by realizing 
that in order to make, say, a mixture of n Bell states 
with an even number of singlets, we can take a mixture 
of n — 1 Bell states with an odd number of singlets and an 
additional singlet or (with the appropriate probability) 
a mixture of n — 1 Bell states with an even number of 
singlets and another Bell state which is not a singlet. 
Solving the recurrence relations for these two den- 



sity matrices, we find that p 



(n) 



and Pi 



are both so- 
called Werner density matrices |19]: linear combina- 
tions of the identity matrix / and the matrix H = 
(1 (g) T)®"[|$+)($+|®"]. In particular, p^ ] oc I + 2 n H 
2 n H. It is known from previous work that 



and p™ oc / - 



the Werner state p^ is unentangled |16|]. In fact, we can 
show H that it is possible to make pg by first choosing a 
random element U of the Clifford group C n [[l7) and then 
applying U® U on the state |0)® n (g> |0>®", i.e. the hider 
applies the same rotation U on both n-qubit shares of the 
state. It can be shown that this procedure takes 0(n 2 ) 
1-qubit and 2-qubit gates 17 and polynomial classical 
computation 0. On the other hand, the Werner state 

(n) 

p\ is entangled; its entanglement of formation is known 
to be one ebit Jlgf| , Using Eq. (|^) for p^ 1 ' and the fact 
that p^ is unentangled, we show explicitly how the hider 
can recursively create p^ using just one singlet: (1) The 
hider flips a coin with bias p n for 0, and bias 1 — p n for 1. 
(2) If the outcome is 0, then the hider prepares a tensor 
product of Pq™ ^ and one singlet |^ r_ )(^~|. This costs 
one ebit, since Pq" ^ is unentangled. If the outcome is 1, 
then she prepares p^™ (g) Pg . Here p^ again requires 
no entanglement, and pi ^ can similarly be prepared 
by the process just described. 

Finally, we note that the obvious extension of the pro- 
tocol presented here permits the sharing of an arbitrary 
number of bits. The hider simply encodes every bit in 
a different block of Bell states as discussed above. The 
security analysis is more involved, since it cannot be ex- 
cluded that joint measurements on all tensor product 
components provide more information than a measure- 
ment on each component separately. By exploiting the 
symmetry of the hiding states as expressed by their rep- 
resentation as Werner states, we are able to bound the 
mutual information I(B : M) = I(B 1 B 2 ...B k :M)<e, 
where M is now any multi-state random variable ob- 
tained from a measurement scheme on the k encoded 
bits, provided that n, the number of Bell states in each 



block encoding B t , scales as n(fe) — > 2fc+logfc+logloge-|- 
logl/e in the large k limit. This result has been derived 
H for the case of equal prior probabilities l/2 fc for all 
fc-bit strings. 

In conclusion, we have shown how to share bits in a pair 
of quantum states such that an Alice and a Bob who do 
not share quantum entanglement and cannot communi- 
cate quantum data, can learn arbitrarily little informa- 
tion about the bits, whereas Alice and Bob can obtain 
the bits reliably if they are given these resources. 
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